Ransomware

Lazarus Group Deploys Medusa Ransomware in Middle East and U.S. Healthcare Attacks

The North Korea aligned threat collective Lazarus Group, also tracked under alternative names such as Diamond Sleet and Pompilus, has been linked to fresh ransomware activity impacting organizations in the Middle East and the United States healthcare sector. According to research published by the Symantec and Carbon Black Threat Hunter Team, part of Broadcom, the group leveraged […]

Lazarus Group Deploys Medusa Ransomware in Middle East and U.S. Healthcare Attacks Read More »

Mississippi Medical Center Shuts Down All Clinics Following Ransomware Attack

A major healthcare provider in the United States has temporarily closed all its clinic locations following a disruptive cyberattack. The University of Mississippi Medical Center (UMMC) confirmed that a ransomware incident forced it to shut down multiple IT systems while emergency protocols were activated to maintain patient care. Authorities at the federal level are now

Mississippi Medical Center Shuts Down All Clinics Following Ransomware Attack Read More »

Poland Arrests Suspect Tied to Phobos Ransomware Operation

Authorities in Poland have arrested a 47-year-old man suspected of involvement with the Phobos ransomware network. During the operation, police confiscated computers and mobile devices allegedly containing stolen login credentials, payment card details, and server access information. The arrest was carried out by officers from the Central Bureau of Cybercrime Control in the Małopolska region, with support from units in Katowice

Poland Arrests Suspect Tied to Phobos Ransomware Operation Read More »

Reynolds Ransomware Uses BYOVD Driver to Disable EDR Security Tools

Cybersecurity analysts have identified a newly emerging ransomware strain named Reynolds, notable for embedding a built-in Bring Your Own Vulnerable Driver (BYOVD) mechanism directly within its ransomware payload. This approach is designed to bypass endpoint security defenses before file encryption begins. BYOVD is a well-known attacker technique that abuses legitimate but vulnerable kernel drivers to escalate

Reynolds Ransomware Uses BYOVD Driver to Disable EDR Security Tools Read More »

New Osiris Ransomware Strain Uses POORTRY Driver in BYOVD Attacks

Cybersecurity researchers have uncovered a new ransomware strain called Osiris, which targeted a major food service franchise operator in Southeast Asia in November 2025. The attack demonstrates advanced techniques, including the use of a malicious driver named POORTRY in a bring your own vulnerable driver (BYOVD) attack to disable security software. Osiris: A Brand-New Ransomware Strain Osiris is a completely

New Osiris Ransomware Strain Uses POORTRY Driver in BYOVD Attacks Read More »

Black Basta Ransomware Leader Added to EU Most Wanted List and INTERPOL Red Notice

Law enforcement authorities in Ukraine and Germany have identified two Ukrainian nationals suspected of supporting the Russia linked Black Basta ransomware as a service operation. Officials also confirmed that the alleged leader of the group has now been placed on both the European Union Most Wanted list and INTERPOL Red Notice database. The suspect has been named as Oleg Evgenievich Nefedov, a 35

Black Basta Ransomware Leader Added to EU Most Wanted List and INTERPOL Red Notice Read More »

Fog Ransomware Targets US Organizations Using Compromised VPN Credentials

A new ransomware variant known as Fog has emerged as a notable threat to organizations in the education and recreation sectors across the United States. Overview of the Threat Starting in early May 2024, Arctic Wolf Labs began monitoring Fog ransomware in multiple incident response cases. Approximately 80 percent of affected organizations operate in education,

Fog Ransomware Targets US Organizations Using Compromised VPN Credentials Read More »

INTERPOL Arrests 574 Across Africa as Ukrainian Ransomware Affiliate Pleads Guilty

A large scale law enforcement operation led by INTERPOL has resulted in the arrest of 574 suspects across Africa and the recovery of approximately three million dollars, marking a significant step in the global fight against cybercrime. The month long initiative, known as Operation Sentinel, was carried out between October 27 and November 27, 2025. The

INTERPOL Arrests 574 Across Africa as Ukrainian Ransomware Affiliate Pleads Guilty Read More »

VolkLocker Ransomware Exposed After Hard Coded Master Key Enables Free Decryption

Cybersecurity researchers have exposed a critical design flaw in a new ransomware strain called VolkLocker, allowing victims to recover their files without paying a ransom. The malware is operated by the pro Russian hacktivist group CyberVolk, also known as GLORIAMIST, and is offered under a ransomware as a service model. The weakness lies in poor

VolkLocker Ransomware Exposed After Hard Coded Master Key Enables Free Decryption Read More »

STAC6565 Focuses on Canada in Most Attacks While Gold Blade Spreads QWCrypt Ransomware

Canadian organizations have become the primary focus of a targeted cyber campaign led by the threat cluster STAC6565. Cybersecurity company Sophos investigated nearly 40 intrusions linked to the group between February 2024 and August 2025, finding strong overlaps with the hacking group Gold Blade, also tracked under names such as Earth Kapre, RedCurl, and Red

STAC6565 Focuses on Canada in Most Attacks While Gold Blade Spreads QWCrypt Ransomware Read More »